I think I like the SystemError approach for the same reasons.  It still exposes the caller's bug but no longer does bad things.